亚马逊-广告SP洞察报告

• Outcome: Review
• Latest audit: Aug 21, 2026 · 10:29 AM UTC
• Version: 1.0.0

Overview

The reporting feature is mostly scoped, but the package also includes account login, API-key generation, and payment flows that go beyond a simple Amazon Ads report skill.

Install only if you trust LinkFox with Amazon Ads reporting data and are comfortable with optional LinkFox account, API-key, and billing workflows. Prefer self-service account setup where possible, avoid custom LINKFOX_* API URL overrides unless you control the endpoint, and treat generated API keys, report files, cache files, and payment QR files as sensitive.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (14)

Tainted flow: 'req' from os.environ.get (line 111, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 84% confidence
• Finding: The request sent by `urlopen` includes sensitive credentials and metadata sourced from environment variables, and the destination base URL is also overrideable through `LINKFOX_TOOL_GATEWAY`. If an attacker can influence the environment, they can redirect requests and exfiltrate the API key and session identifiers to an attacker-controlled endpoint.

Tainted flow: 'req' from os.environ.get (line 111, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 78% confidence
• Finding: Environment-derived values influence the outbound HTTP request: the destination base URL comes from `LINKFOX_TOOL_GATEWAY`, and sensitive headers include the API key plus session metadata. If an attacker can control environment variables in the agent runtime, they can redirect the request to an attacker-controlled host and exfiltrate credentials and operational metadata; in a skill context that routinely runs with secrets, this is materially dangerous.

Tainted flow: 'url' from os.environ.get (line 236, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 87% confidence
• Finding: The POST target is derived from environment-controlled base URLs and then used to transmit sensitive data such as phone numbers, SMS codes, access tokens, refresh tokens, and generated API keys. In a skill environment, an attacker who can influence environment variables can redirect these authentication flows to an attacker-controlled endpoint, causing credential exfiltration and account compromise.

Tainted flow: 'req' from os.environ.get (line 245, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 84% confidence
• Finding: The gateway request URL is built from environment-derived base URLs and used with an Authorization header containing the API key. If those environment variables are manipulated, requests can be sent to an attacker-controlled server, leaking the API key and enabling unauthorized use of the user's LinkFox account or credits.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill explicitly instructs execution of Python scripts, network calls to Amazon Ads, shell invocation, and file writes, but no permissions are declared. That creates a transparency and policy-enforcement gap: an agent or reviewer cannot accurately constrain what the skill can do, increasing the chance of over-privileged execution or unsafe deployment.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The file introduces authentication, account registration, and billing/purchase workflows that are outside the stated purpose of an Amazon Ads SP insights reporting skill. This expands the skill’s operational scope into credential handling, phone-based signup, and payment guidance, increasing the attack surface and creating opportunities for social engineering or misuse if triggered inappropriately.

Description-Behavior Mismatch

Medium

• Confidence: 76% confidence
• Finding: The script is advertised as narrowly scoped to SP audience insights, but it forwards caller-supplied parameters into a generic reporting workflow without enforcing report-type constraints locally. That can let callers obtain unintended report classes or broader data than the skill contract promises, undermining authorization and least-privilege assumptions around tool selection.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This file implements SMS login, API key retrieval, plan purchase, order creation, and payment QR generation, which are unrelated to the declared Amazon Ads SP insights reporting purpose. Scope-divergent onboarding and monetization logic increases the chance that the skill is collecting credentials and driving commerce outside the user's expected task, making the overall package substantially riskier.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: Commerce features such as package lookup, paid order creation, payment URLs, and QR rendering are not justified by a reporting-only skill. This broadens the trust boundary from reporting into billing and payment handling, creating opportunities for abuse, coercive upsell, and collection of unnecessary user/payment metadata.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The skill performs SMS authentication, token exchange, user/team discovery, and API token generation even though its stated purpose is generating Amazon Ads SP insight reports. This is dangerous because it directly handles high-value credentials and account bootstrap operations that users would not expect from a reporting skill, increasing credential theft and account takeover risk.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The instructions ask the user to provide a phone number and then use a script to send codes and log in, but they do not disclose data handling, transmission, storage, or privacy implications. Collecting personal data without a clear warning and consent flow can expose users to privacy violations and unauthorized account creation or access.

Missing User Warnings

Medium

• Confidence: 79% confidence
• Finding: The QR rendering logic writes payment QR PNG files into workspace, home, or temp directories without any explicit warning or retention control. Those files may persist after execution and could expose payment links, order metadata, or user activity to other local users, tools, or later processes in the same environment.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The login flow returns an API key directly to stdout JSON, which is a sensitive credential that may be captured by logs, transcripts, calling frameworks, or other tools in the agent environment. In a skill context, secrets printed to standard output are often more exposed than users realize, making credential leakage likely.

External Transmission

Medium

• Category: Data Exfiltration

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 81% confidence
• Finding: This code transmits authentication and account-related data to external services via HTTP requests. In isolation that can be legitimate, but in this file the transmitted data includes sensitive login and token material and the destination can be environment-influenced, making external transmission materially dangerous.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.